Example from a SAML Response: <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="https://testsp2.aai.dfn.de/shibboleth"; SPNameQualifier="h ttps://testsp2.aai.dfn.de/shibboleth">3x51T1uQTYjBNVWkRoLPdzSkgCE=</saml2:NameID>
It seems in SamlProfileSamlNameIdBuilder#finalizeNameId the NameQualifier is not set correctly. If no explicit nameIdQualifier is set for a SAMLService, the NameQualifier has to be the entityId of the IdP or of the relying party. In all of my testcases the NameQualifier was set to the issuer of the AuthnRequest, which is the SP. Thats why the Shibboleth SP ignores the subject ID. My quickfix would be the use the entityId of the IdP, but that will not handle relying IdPs. Is it a bug? Should I open a PR? -- You received this message because you are subscribed to the Google Groups "CAS Developer" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-dev/165dbd9e-9fa1-4e1a-9071-7b7d87556d72n%40apereo.org.
